Network
=======

Office network
--------------

For the network infrastructure at the office, we're using `UniFi <https://www.ui.com/>`_ equipment:

- UniFi Switches
- UniFi Security Gateway
- UniFi Access Points

UniFi Cloud Key
~~~~~~~~~~~~~~~

To manage the UniFi devices, use the dedicated UniFi controller, i.e. UniFi cloud key.

.. seealso::

    Check out the :ref:`Dashboard` for the «UniFi cloud key» link.

LAN
---

We're using ``10.0.0.0/8`` for our private network ranges.

Physical LAN networks
~~~~~~~~~~~~~~~~~~~~~

All physical networks (clients & servers) use IPs from the ``10.0.0.0/12`` subnet.

To see the network subnets, check out the :ref:`UniFi Cloud Key`:

- ``Settings`` → ``Networks`` (VLANs)
- ``Settings`` → ``VPN`` → ``Site-to-Site VPN`` → ``{VPN}`` → ``Subnet``

Docker LAN networks
~~~~~~~~~~~~~~~~~~~

All Docker networks use IPs from the ``10.16.0.0/12`` subnet:

+------------------+---------------------------------+
|      Subnet      |              Usage              |
+==================+=================================+
| ``10.16.0.0/16`` | Default Docker bridge           |
+------------------+---------------------------------+
| ``10.17.0.0/16`` | :ref:`Proxy` network            |
+------------------+---------------------------------+
| ``10.18.0.0/16`` | Compose project bridge networks |
+------------------+---------------------------------+

Other LAN networks
~~~~~~~~~~~~~~~~~~

All other LAN networks use IPs from the ``10.32.0.0/12`` subnet:

+------------------+--------------------------------------+
|      Subnet      |                Usage                 |
+==================+======================================+
| ``10.32.0.0/24`` | cudy OTG mobile router               |
+------------------+--------------------------------------+
| ``10.32.1.0/24`` | Netgear Nethawk mobile router        |
+------------------+--------------------------------------+
| ``10.40.0.0/16`` | Reserved subnet for local networking |
+------------------+--------------------------------------+

.. hint::

    Try to use the ``10.40.0.0/16`` for your network subnets on your local machine.

Office LAN IPs
~~~~~~~~~~~~~~

The office LAN IPs are managed in the :ref:`UniFi Cloud Key`.

Server LAN IPs
~~~~~~~~~~~~~~

The server LAN IPs are managed in :ref:`Ansible`.

.. hint::

    You can use the ``create_host_list.yml`` `playbook <https://gitlab.confirm.ch/confirm/infrastructure/ansible/projects/confirm/-/tree/main/playbooks>`_ to create a ``host_list.txt`` file containing all host IPs.

Firewalls
~~~~~~~~~

To protect our network, we're using firewalls.
Check out the :ref:`Firewall` chapter for more information.

VPNs
~~~~

To interconnect our networks and access them remotely, we're using VPNs.
Check out the :ref:`VPN` chapter for more information.

WAN
---

Office WAN
~~~~~~~~~~

At the office we have a fixed and native IPv4 address ``84.254.96.223``.

We also have a routed IPv4 subnet ``217.71.252.24/29`` over the native IP address.

+----------------------+---------------------+-------------------------------+
|     IPv4 address     |        Usage        |            DNS PTR            |
+======================+=====================+===============================+
| ``217.71.252.24/29`` | *n/a: network ID*   |                               |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.25/29`` | Gateway             |                               |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.26/29`` | Management services | ``management.wan.confirm.ch`` |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.27/29`` | Eve server          | ``eve.wan.confirm.ch``        |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.28/29`` |                     |                               |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.29/29`` |                     |                               |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.30/29`` |                     |                               |
+----------------------+---------------------+-------------------------------+
| ``217.71.252.31/29`` | *n/a: broadcast*    |                               |
+----------------------+---------------------+-------------------------------+

Datacenter WAN
~~~~~~~~~~~~~~

At the datacenter, we have a fixed and native IPv4 address ``195.201.104.241``.
It's assigned to the :ref:`Proxmox`.

We also have a routed IPv4 subnet ``46.4.219.16/28`` over the native IP address:

+---------------------+--------------------------+-----------------------------------+
|     IPv4 address    |          Usage           |              DNS PTR              |
+=====================+==========================+===================================+
| ``46.4.219.16/28``  | *n/a: network ID*        |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.17/28``  | :ref:`Proxmox` (gateway) | ``proxmox.wan.confirm.ch``        |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.18/28``  | Live services            | ``live.wan.confirm.ch``           |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.19/28``  | Customer services        | ``customers.wan.confirm.ch``      |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.20/28``  | Test services            | ``test.wan.confirm.ch``           |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.21/28``  | Development services     | ``development.wan.confirm.ch``    |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.22/28``  | Tinker                   | ``tinker.wan.confirm.ch``         |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.23/28``  | ERP services             | ``erp1.wan.confirm.ch``           |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.24/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.25/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.26/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.27/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.28/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.29/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.30/28``  |                          |                                   |
+---------------------+--------------------------+-----------------------------------+
| ``46.4.219.31/28``  | *n/a: broadcast*         |                                   |
+---------------------+--------------------------+-----------------------------------+

Server WAN IPs
~~~~~~~~~~~~~~

The server WAN IPs are managed in :ref:`Ansible`.

.. hint::

    You can use the ``create_host_list.yml`` playbook to create a ``host_list.txt`` file containing all host IPs.